| Summary: | Security Tools - consider fedora/gentoo runtime security tools | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] Meta-yocto | Reporter: | Richard Purdie <richard.purdie> |
| Component: | meta-yocto | Assignee: | Andrei Dinu <andrei.adrianx.dinu> |
| Status: | VERIFIED FIXED | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | High | CC: | corneliux.stoicescu, jessica.zhang, jiajun.xu, josh, laurentiu.serban, mulhern, poky.bs.watcher, poky.watcher, radu.moisan, razvanx.ionescu, sgw, sh88ting.star, song.liu, sstncr |
| Version: | unspecified | ||
| Target Milestone: | 1.5 M2 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 4692 | ||
|
Description
Richard Purdie
2011-10-04 06:47:29 UTC
Fedora's security assessment tool is: http://people.redhat.com/sgrubb/security/index.html Gentoo's security assessment tool is: http://www.gentoo.org/proj/en/hardened/pax-utils.xml I would like to look into these tools and add them into QA testing. I would like to move the feature to M3 since there are other high priority tasks in M3 Reassing this to Mihai Lindner So just to be clearer about the intent of this bug, the idea is to look at the checks Fedora and Gentoo are making from a security standpoint and see which would be appropriate for the Yocto Project. Ideally these would be implemented as automated tests as part of insane.bbclass or tests at the image level against built images. There may be some dependency on the new QA infrastructure here, however that doesn't stop us completing the planning of what tests we want to add. After looking through the scripts in the links, and also assessing the suggestions made by Costel Maxim ( sectool, checksecurity, buck-security and portaudit ), i found out that neither of them are hardening tools. Most of them run a check on specific areas of the system and simply report the problems found. I know that we want to have a hardening tool which protects the image, for that we have Bastille. I would like to know what do you suggest for these tools? Should i include them in the security layer or should i integrate them with the new testing framework that Radu and Stefan are developing, in order to report to the user the security issues that affect each image after it is built ? We should create a layer, some of those tools might be used by the host or the target to verify that no changes have occurred, so for example if a new tool is added or a packages's recipe is modified, it does not cause a new port to be open, that should cause a red-flag in the test report, until it is verified as correct or not. So having the tools as a meta-security/recipes-security layer gives us the flexibility to include them or move them to oe-core if appropriate. Some of the tools may be both target and native tools. The test framework will be able to execute these tests if they are included in the final image, or are available in the native sysroot. Another one I recently heard about: http://sourceforge.net/projects/libseccomp, not sure if it applies or not redhat-security scripts status: Out of all the used scripts, the following require some changes/additions in order to work: * find-elf4tmp.sh - patch the script to use 'strings' instead of 'eu-strings' - patch the script to look for the busybox versions of 'sort' and 'awk'; these are located in '/usr/bin' instead of '/bin' * find-elf4tmp.sh - this script needs libcap-ng-utils in order to run The security tools can be found in : http://git.yoctoproject.org/cgit/cgit.cgi/meta-security under /recipes-security/redhat-security pax-utils and redhat-security can be added to images via IMAGE_INSTALL_append after adding meta-security to bblayers.conf. |